https://github.com/osquery/osquery logo
Title
s

sean.cavanaugh

01/21/2019, 7:55 PM
I’m interested if it scales well provided adequate infrastructure and if file locks are an issue
t

thor

01/22/2019, 5:13 AM
I don't think file locks are typically an issue. We open a handle with read perms as root, so we can typically get the data. You can ping #file-carving for more questions, but we've had pretty good uses with it 🙂 There's a really good issue with instructions on how to setup ones own TLS endpoint for it here: https://github.com/mwielgoszewski/doorman/issues/120
s

sean.cavanaugh

01/22/2019, 1:55 PM
Thanks @thor, much appreciated